Skip to main content

How to enable Okta Single Sign-on

This guide will walk you through configuring Okta to enable seamless access using your team's existing Okta credentials.

How to Set up Okta SSO?

Create the Application

  1. Navigate to Applications, and select Applications.
  2. Click on Create App Integration.

For SAML

  1. Select SAML 2.0.
  2. Provide an App name and click Next.
  3. Enter Single sign-on URL: htpps://auth.thebrief.ai/auth/realms/creatopy/broker/{YOUR_ALIAS}/endpoint and Audience URI (SP Entity ID): https://auth.thebrief.ai/auth/realms/creatopy
  4. Once done, copy the Metadata URL, add it to The Brief, and click Test connection & finish setup.

For OIDC

  1. Click on OIDC - OpenID Connect, and select Web Application.
  2. Set sign-in redirect URI and sign-out redirect URI to: htpps://auth.thebrief.ai/auth/realms/creatopy/broker/{YOUR_ALIAS}/endpoint and click Allow everyone in the organization to join.
  3. Copy Client ID, Client secret, and for the autoconfig URL, copy the base URL from the browser: dev-{RANDOM-ID}-admin.okta.com Click on Create App Integration. and add /.well-known/openid-configuration e.g., (https://dev-3189947-admin.okta.com/.well-known/openid-configuration)
  4. Once done, copy the Metadata URL, add it to The Brief, and click Test connection & finish setup.

Create Users

  1. Click Directory, and select People.
  2. Click Add Person and insert the credentials.

General Troubleshooting

OIDC

  • If, after entering the mail on the Sign-in with SSO page, you receive an error on an external page (from the external identity provider), the issue can be caused by:
    • The application on the identity provider page is not active.
    • Configuration issues with ClientID, Client Secret, or the redirect URI.
    • You're already logged in with a user that does not have access to the application.
  • If, after entering the credentials, you receive an error, it can be caused by:
    • The user doesn't have access to the application.
    • The redirect URI is not correct.
  • If you are redirected to The confirmation link expired The Brief page after entering the credentials, there is usually a mismatch between some advanced settings on the SSO settings page and the ones on the external identity provider. Things to look out for:
    • If the client authentication method is the same on the application as on the SSO settings page.
    • If the Validate Signatures check is on on the SSO settings page, check the algorithm used for the signature. Another easy fix is to disable the Validate Signature.

SAML

  • If, after entering the email on the Sign-in with SSO page, you receive an error on an external page (from the external identity provider), usually there is an issue with:
    • The application on the identity provider page is not active.
    • Configuration issues with the Single sign-on service URL or the Service Provider Entity ID.
    • You're already logged in with a user that does not have access to the application.
  • If, after entering the credentials, you receive an error, it can be caused by:
    • The user doesn't have access to the application.
    • Not entering the correct Single logout URL on the external identity provider application.
  • If you are redirected to The confirmation link expired The Brief page after entering the credentials, there is usually a mismatch between some advanced settings on the SSO settings page and the ones on the external identity provider application.

Important: If the SAML configuration is done on both sides using the URL on the XML file, there are usually no errors. If there are still some issues, the first things to look for are the Application being active on the external provider and the users having access to it.

Related articles